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TN THE CLAIMS 
Amended claims follow: 

1 . (Currently Amended) A method for detecting modifications to risk assessment 
scanning caused by an intermediate device, comprising: 

(a) initiating a risk assessment scanjrtand on a target, from a remote source utilizing 
a network; 

(b) determining whether the risk assessment scanat and on the target involves an 
intermediate device coupled between the target and the remote source; 

(c) receiving results of the risk assessment scan from the target utilizing the network; 
and 

(d) notifying an adininistratoi if it is determined that the risk assessment scanaLand. 
on the target involves the intermediate device, wherein additional operations are 
carried out to improve a risk assessmentjrtand on the target in view of the 
presence of the intermediate device coupled between the target and the remote 
source; 

wherein a plurality of procedures are utilized to determine whether the risk 
assessment scan involves the intermediate device. 

2. (Original) The method as recited in claim 1, wherein the intermediate device 
includes a router. 



(Cancelled) 



(Previously Presented) The method as recited in claim 1, wherein at least one of 
the procedures includes determining a port list associated with the risk assessment 



scan. 
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5. (Original) The method as recited in claim 4, wherein the at least one of the 
procedures further includes determining whether a value of a flag is different for 
communication attempts using at least two ports on the port list 

6. (Original) The method as recited in claim 5, wherein the flag includes an ip_ttl 
flag. 

7. (Original) The method as recited in claim 5, wherein the flag includes a tcpjwin 
flag. 

8. (Original) The method as recited in claim 5, wherein the communications include 
connection attempts between the remote source and the target utilizing the 
network. 

9. (Original) The method as recited in claim 5, wherein the at least one of the 
procedures further includes indicating that the risk assessment scan involves the 
intermediate device if the value of the flag is different for the communication 
attempts using the at least two ports on the port list, 

10. (Previously Presented) The method as recited in claim 1 , wherein at least one of 
the procedures includes transmitting a first request for content to the target 
utilizing the network, and transmitting a second request for a cached version of 
the content to the target utilizing the network. 

1 1 . (Original) The method as recited in claim 10, wherein the cached content is 
requested from the target utilizing a via tag. 

12. (Original) The method as recited in claim 10, wherein the at least one of the 
procedures further includes analyzing responses to the first and second requests. 
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13. (Original) The method as recited in claim 12, wherein the at least one of the 
procedures further includes indicating that the risk assessment scan involves the 
intermediate device based on the analysis. 

14. (Original) The method as recited in claim 13, wherein the at least one of the 
procedures further includes indicating that the risk assessment scan involves the 
intermediate device if the responses to the requests are different. 

15. (Previously Presented) The method as recited in claim 1 , wherein at least one of 
the procedures includes transmitting a request without specifying a host header 
value. 

16. (Original) The method as recited in claim 15, wherein the at least one of the 
procedures further includes identifying an error message in response to the 
request. 

17. (Original) The method as recited in claim 16, wherein the at least one of the 
procedures includes indicating that the risk assessment scan involves the 
intermediate device if the response includes the error message. 

1 8 . (Currently Amended) A computer program product for detecting modifications to 
risk assessment scanning caused by an intermediate device, comprising: 

(a) computer code for initiating a risk assessment scanatand on a target^ from a 
remote source utilizing a network; 

(b) computer code for determining whether the risk assessment scanatand on the 
target involves an intermediate device coupled between the target and the remote 
source; 

(c) computer code for receiving results of the risk assessment scan from the target 
utilizing the network; and 

(d) computer code for notifying an administrator if it is determined that the risk 
assessment sca n at and on the target involves the intermediate device; 
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wherein additional operations are carried out to improve a risk assessmentatand 
on the target in view of the presence of the intermediate device coupled between 
the target and the remote source; 

wherein a plurality of procedures are utilized to determine whether the risk 
assessment scan involves the intermediate device. 

1 9. (Original) The computer program product as recited in claim 1 8, wherein the 
intermediate device includes a router, 

20. (Original) The computer program product as recited in claim 1 8, wherein the 
intermediate device includes a proxy server. 

21. (Cancelled) 

22. (Previously Presented) The computer program product as recited in claim 1 8, 
wherein at least one of the procedures includes determining a port list associated 
with the risk assessment scan. 

23 . (Original)The computer program product as recited in claim 22, wherein the at 
least one of the procedures further includes determining whether a value of a flag 
is different for communication attempts using at least two ports on the port list. 

24. (Original) The computer program product as recited in claim 23, wherein the flag 
includes an ip_ttl flag. 

25. (Original) The computer program product as recited in claim 23, wherein the flag 
includes a tcp_win flag. 

26. (Original) The computer program product as recited in claim 23, wherein the 
communications include connection attempts between the remote source and the 
target utilizing the network. 



PAGE 8/17 1 RCVD AT 113(112006 2:38:21 PM [Eastern Standard Time] 1 SVWTO-EFXIOT ' DNB:2738300 * CSH):4089714660 1 DURATION (mm-ss):0346 



i 



JAN. 30. 2006 1 1:49AM ZILKA-KOTAB, PC 



NO. 1762 P. 9 



-6- 

27. (Originaiynie computer program product as recited in claim 23, wherein the at 
least one of the procedures further includes indicating that the risk assessment 
scan involves the intermediate device if the value of the flag is different for the 
communication attempts using the al least two ports on the port list. 

28. (Previously Presented) The computer program product as recited in claim 18, 
wherein at least one of the procedures includes transmitting a first request for 
content to the target utilizing the network, and transmitting a second request for a 
cached version of the content to the target utilizing the network. 

29. (Original) The computer program product as recited in claim 28, wherein the 
cached content is requested from the target utilizing a via tag. 

30. (Original) The computer program product as recited in claim 28 3 wherein the at 
least one of the procedures further includes analyzing responses to the first and 
second requests. 

3 1 . (Original) The computer program product as recited in claim 30, wherein the at 
least one of the procedures further includes indicating that the risk assessment 
scan involves the intermediate device based on the analysis. 

32. (Original) The computer program product as recited in claim 31, wherein the at 
least one of the procedures further includes indicating that the risk assessment 
scan involves the intermediate device if the responses to the requests are different. 

33. (Previously Presented) The computer program product as recited in claim 18, 
wherein at least one of the procedures includes transmitting a request without 
specifying a host header value. 
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34. (Original) The computer program product as recited in claim 33, wherein the at 
least one of the procedures further includes identifying an error message in 
response to the request 

35, (Original) The computer program product as recited in claim 34, wherein the at 
least one of the procedures includes indicating that the risk assessment scan 
involves the intermediate device if the response includes the error message, 



36. (Currently Amended) A system for detecting modifications to risk assessment 
scanning caused by an intermediate device, comprising: 

(a) logic for initiating a risk assessment sca n at and on a target, from a remote source 
utilizing a network; 

(b) logic for determining whether the risk assessment sca n at an d on the target 
involves an intermediate device coupled between the target and the remote 
source; 

(c) logic for receiving results of the risk assessment scan from the target utilizing the 
network; and 

(d) logic for notifying an administrator if it is determined that the risk assessment 
scan jit and on the target involves the intermediate device; 

wherein additional operations are carried out to improve a risk assessment_aLand 
on the target in view of the presence of the intermediate device coupled between 
the target and the remote source; 

wherein a plurality of procedures are utilized to determine whether the risk 
assessment scan involves the intermediate device. 

37. (Currently Amended) A method for detecting modifications to risk assessment 

scanning caused by a proxy server, comprising: 
(a) initiating a risk assessment sca n at and on a target^ from a remote source utilizing 

a network; 
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executing a plurality of procedures to determine whether the risk assessment scan 
at and on the target involves a proxy server coupled between the target and the 
remote source; 

said procedures utilizing a plurality of parameters selected from the group 
consisting of an ipjtl flag, a tcp_win flag, a via tag, and a host header value; 
receiving results of the risk assessment scan from the target utilizing the network; 
flagging the results of the risk assessment scan if at least one of the procedures 
indicates that the risk assessment scan involves a proxy server coupled between 
the target and the remote source; and 

notifying an administrator if the results of the risk assessment scan at and on the 
target are flagged; 

wherein additional operations are carried out to improve a risk assessments and 
on the target in view of the presence of the proxy server coupled between the 
target and the remote source. 

3 S . (Currently Amended) A computer program product for detecting modifications to 
risk assessment scanning caused by a proxy server, comprising: 

(a) computer code for initiating a risk assessment sca n at and on a target^ from a 
remote source utilizing a network; 

(b) computer code for executing a plurality of procedures to determine whether the 
risk assessment scanatjnd on the target involves a proxy server coupled between 
the target and the remote source; 

(c) said procedures utilizing a plurality of parameters selected from the group 
consisting of an ip_ttl flag, a tcp_win flag, a via tag, and a host header value; 

(d) computer code for receiving results of the risk assessment scan from the target 
utilizing the network; 

(e) computer code for flagging the results of the risk assessment scan if at least one of 
the procedures indicates that the risk assessment scan involves a proxy server 
coupled between the target and the remote source; 

(f) computer code for notifying an administrator if the results of the risk assessment 
sca n at and on the target are flagged; 



(b) 
(c) 

(d) 

(e) 
(f> 
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wherein additional operations are carried out to improve a risk assessment jtand 
on the target in view of the presence of the proxy server coupled between the 
target and the remote source. 

39. (Original - Renumbered) The method as recited in claim 1 , wherein the 
intermediate device includes a proxy server. 
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